The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources including GitHub pull request comments, check run outputs, and API logs. This creates a potential attack surface where malicious actors could embed instructions within these fields to influence the agent's behavior.
Ingestion points: The skill explicitly instructs the agent to read pull request comments using gh api .../comments, check run titles and summaries via gh api .../check-runs, and Mergify activity logs using curl. These sources are populated by user comments and external CI provider outputs.
Boundary markers: There are no specific boundary markers or instructions provided to the agent to treat this ingested content as data rather than instructions, nor are there warnings to ignore embedded commands.
Capability inventory: The agent has access to the mergify CLI, the gh CLI for repository interaction, and curl for making network requests to api.mergify.com (a vendor-owned domain).
Sanitization: The instructions do not include any logic for sanitizing or escaping the content retrieved from these external sources before the agent processes it.

mergify-merge-queue